Skip to main content
Glama
doublegate

CyberChef MCP Server

by doublegate

cyberchef_entropy_scan

Read-onlyIdempotent

Locates high-entropy regions in files, reports offsets, and uses chi-squared and serial correlation to distinguish compressed from encrypted data.

Instructions

Find WHERE a file's entropy is high, not just whether it is: contiguous regions above a threshold, with offsets. CyberChef's Entropy curve has a fixed 256-byte bin, no threshold and no region output. Applies Lyda and Hamrock's packed-binary rule (a CONJUNCTION of mean > 6.677 and peak > 7.199, not the single 7.0 usually quoted) and adds chi-squared and serial correlation as a second axis, which is what separates compressed from encrypted. Reports what a high number does and does not establish.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
inputYesThe data.
thresholdNoBits per byte above which a window counts as high-entropy. 7.0 is conventional and weak; the report says why.
step_bytesNoDistance between windows. Defaults to the window size, i.e. no overlap.
max_regionsNoHow many regions to return.
input_formatNoHow `input` is encoded.Raw
window_bytesNoWindow size for the sliding scan. 256 is the sourced figure; a larger window hides encryption that exists only in small areas.

Schema Changelog

Changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. First observedv3.6.0

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already establish read-only, idempotent, and non-destructive behavior. The description adds meaningful behavioral detail on top: the exact Lyda-Hamrock conjunction thresholds, the second chi-squared/serial-correlation axis, and an explicit caveat that the report states what a high number does and does not establish.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but every sentence earns its place: purpose, comparison to the naive alternative, methodology, and interpretative limits. The most important capability is front-loaded in the first sentence.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description provides strong context for a read-only scan with six parameters and no output schema: what it scans for, the algorithm, and the caveat about interpretation. It leaves the exact return structure somewhat implicit, but the schema covers all inputs and the core behavior is clear.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the parameters are already well documented. The description adds conceptual context about thresholds and windows but does not need to repeat per-parameter details; the baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The first sentence states a specific verb and resource: find WHERE entropy is high in a file, returning contiguous regions above a threshold with offsets. It clearly distinguishes the tool from CyberChef's generic Entropy curve by naming what is missing there (fixed 256-byte bin, no threshold, no region output).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear context for when this tool adds value: locating high-entropy regions and separating compressed data from encrypted data. It contrasts with CyberChef's Entropy curve and says it goes beyond a simple 'whether' answer, but it stops short of an explicit, structured when-to-use/when-not-to-use guide with named sibling tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/doublegate/CyberChef-MCP'

If you have feedback or need assistance with the MCP directory API, please join our Discord server